April 15, 2027 Root CA Distrust: Will Your Mail Server's Certificate Still Be Trusted?

Short answer: On 15 Apr 2027 Mozilla removes TLS trust from 19 roots with keys over 15 years old, including USERTrust RSA/ECC, COMODO RSA/ECC, Go Daddy Root G2, Starfield G2 and GlobalSign R3. Mail servers whose chain ends only at one of them will fail strict certificate checks. Check your chain and relays now.

WhoMozilla, Chrome and the CAs
Statusconfirmed
Dates
  • 2027-04-15: Mozilla removes the websites (TLS) trust bit from roots with 2008–2009 key material; Sectigo lists Chrome and Mozilla distrust of its COMODO and USERTrust roots on the same day

Who is affected

Mail servers and SMTP relays whose certificate chain ends only at one of the 2027 roots, as seen by clients that use Mozilla-based trust stores (Thunderbird, curl's CA bundle and the many tools built on it) and by senders that enforce MTA-STS. Our check on 25 Oct 2026 found two big providers in that position, so this is a risk to watch, not a certain outage.

What you will see

Check your setup today

  1. Show the chain a server sends: openssl s_client -starttls smtp -connect smtp.example.com:587 -servername smtp.example.com -showcerts </dev/null. Use port 25 for an MX; for IMAP use -connect imap.example.com:993 without -starttls smtp.
  2. Read the i: (issuer) line of the last certificate. If it names USERTrust RSA or ECC Certification Authority, COMODO RSA or ECC Certification Authority, Go Daddy Root Certificate Authority - G2, Starfield Root Certificate Authority - G2, Starfield Services Root Certificate Authority - G2 or GlobalSign Root CA - R3, the chain depends on a root on Mozilla's 2027 list (19 roots in total).
  3. Check the relays you send through, not just your own MX. On 25 Oct 2026 smtp.sendgrid.net:587 ended at Go Daddy Root G2 (its certificate expires 19 Dec 2026), and smtp.mail.me.com:587 and mx01.mail.icloud.com:25 ended at USERTrust RSA.
  4. If your own domain uses MTA-STS (our checker shows it), run the openssl check on every MX host.

How to fix it

  1. Your own server: reissue the certificate from a current hierarchy. Sectigo tells its customers to move to its R46 and E46 roots; other CAs have their own newer roots.
  2. Install the full chain your CA gives you, including any cross-certificate. GoDaddy, for example, chains its new R1 certificates through G2 while R1 trust spreads.
  3. Relays you don't control (SendGrid, iCloud and others): re-run the check in early 2027. If a relay still ends at a 2027 root in March, ask its support for their plan before 15 April.
  4. Keep the CA bundles on your own servers and apps up to date, so newer roots are known as soon as root programs accept them. GoDaddy says its R1 root is still being added to browser and OS trust stores.
  5. Don't re-add a distrusted root to your trust store as a fix. It hides the problem for you while other senders still fail.

Check your domain now

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.

Related pages

Sources

Other upcoming changes